LiveActive security incident?Get immediate response
CVE Record

CVE-2025-39689: ftrace: Also allocate and copy hash for reading of filter files

In the Linux kernel, the following vulnerability has been resolved: ftrace: Also allocate and copy hash for reading of filter files Currently the reader of set_ftrace_filter and set_ftrace_notrace just adds the pointer to the global tracer hash to its iterator. Unlike the writer that allocates a copy of the hash, the reader keeps the pointer to the filter hashes. This is problematic because this pointer is static across function calls that release the locks that can update the global tracer hashes. This can cause UAF and similar bugs. Allocate and copy the hash for reading the filter files like it is done for the writers. This not only fixes UAF bugs, but also makes the code a bit simpler as it doesn't have to differentiate when to free the iterator's hash between writers and readers.

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A Linux kernel ftrace reader can retain a pointer after the underlying filter data changes, creating a use-after-free condition. A local user with low privileges may be able to trigger memory corruption, potentially affecting confidentiality, integrity, and availability. The supplied evidence rates the issue high severity, not critical.

Executive priority

Treat as a high-priority kernel maintenance issue, especially on shared, multi-user, development, hosting, and appliance systems allowing untrusted local access. Schedule expedited vendor-approved updates, but do not characterize it as an internet-remote or actively exploited emergency based on the supplied evidence.

Technical view

Readers of set_ftrace_filter and set_ftrace_notrace referenced global tracer hashes across operations that released update locks. A concurrent hash change could leave the reader using freed memory. The kernel fix gives readers an allocated hash copy, matching writer behavior and preventing the unsafe lifetime overlap.

Likely exposure

Exposure applies to affected Linux kernels identified by vendor or distribution advisories. The CVSS vector requires local access and low privileges, with no user interaction. Actual exposure may depend on whether an attacker can access the relevant ftrace interfaces; the supplied sources do not document configuration-specific reachability.

Exploitation context

CISA KEV status is false, and the supplied sources provide no evidence of active exploitation. CVSS 3.1 scores the issue 7.8 with local, low-complexity, low-privilege access and potentially high confidentiality, integrity, and availability impact. Public exploit availability is not established by this bundle.

Researcher notes

The defect is a synchronization and object-lifetime failure involving global tracer hashes. Readers retained shared pointers while locks could be released and writers could replace the hashes. The fix copies the hash for each reader. No CWE is supplied, and the provided affected-version data contains duplicate commit entries, so vendor branch mapping should be verified.

Mitigation direction

  • Apply a vendor-supported kernel update containing the referenced ftrace fix.
  • Check distribution and appliance advisories for the correct backported package.
  • Prioritize multi-user systems where untrusted users can obtain local access.
  • Use vendor guidance for temporary controls if immediate kernel replacement is unavailable.
  • Reboot into the updated kernel where required by the vendor package process.

Validation and detection

  • Record the running kernel version on each Linux system.
  • Compare kernel packages against applicable vendor or distribution advisories.
  • Confirm the installed kernel includes the relevant upstream fix or vendor backport.
  • Verify systems booted into the corrected kernel after maintenance.
  • Review local access paths and permissions governing relevant ftrace interfaces.
Prepared
Confidence
medium
Sources
12

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-39689 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
2ADP providers
13Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2025-39689Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
siemens-SADPADP container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxc20489dad156dd9919ebd854bbace46dbd2576a3, c20489dad156dd9919ebd854bbace46dbd2576a3, c20489dad156dd9919ebd854bbace46dbd2576a3, c20489dad156dd9919ebd854bbace46dbd2576a3, c20489dad156dd9919ebd854bbace46dbd2576a3, c20489dad156dd9919ebd854bbace46dbd2576a3, c20489dad156dd9919ebd854bbace46dbd2576a3, c20489dad156dd9919ebd854bbace46dbd2576a3unaffected
LinuxLinux4.12, 0, 5.4.297, 5.10.241, 5.15.190, 6.1.149, 6.6.103, 6.12.44, 6.16.4, 6.17affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.